IBM Security Cache, LTPA Token, and Session Time Outs - United States session; cache; logout; login; timeout; time out; LTPA TECHNOTE (FAQ)

QUESTION
 What happens when the Security Cache, LTPA Token timeout, and session time out?

ANSWER
Question 1
What happens when the Security Cache times out? Will the user be asked to re-login?

Answer 1
No. When using single sign-on (SSO), the Security Cache will refresh from the LTPA Token. If your LTPA Token is also expired, then the user will be asked to re-login. Also, the cache timeout period is reset every time that entry is hit. So, if the entry is hit 9 minutes into the 10 minute timeout period, the clock is reset at that time. So, instead of timing out in another minute, it is now reset for another 10 minutes, then if it's hit again in that time, it will get extended again.

When using Local operating system for authentication, the user will be asked to login when the session times out, not the security cache.

In V6.1, the Federated Repository has it's own cache settings. See the link under Related Information.

Question 2

 1. Using a browser, we accessed a secured application, we provided the UserID (UserA) and a valid PW (Password1). A token was created. So far everything is working fine.

 2. You manually changed the password for UserA in the LTPA (LDAP or custom registry) from Password1 to Password2.
 3. Using a new browser we accessed the application providing UserA and the new password (Password2) a token was created and again everything is working as expected.

 4. Using a another new browser we accessed the application providing UserA and the old password (Password1). You were surprised to notice that a token was created and UserA was able to access the application.

Answer 2
The old password takes up to 1.5 times the security cache to disappear. It will also expire at the end of the LTPA token timeout.

In IBM WebSphere Application Server V5.0.2 and later, you can purge a user from the security cache using an MBean interface. See the Related Information at the end of this article.

Question 3
I want to force my users to re-login after a set "inactivity timeout" period. How is WebSphere Application Server supposed to work with regard to session timeouts and LTPA timeout. Answer 3
See the answer to this question in item 9 of the following developerWorks article:
http://www.ibm.com/developerworks/websphere/techjournal/1003_botzum/1003_botzum.html [http://www.ibm.com/developerworks/websphere/techjournal/1003_botzum/1003_botzum.html]

Question 4
If this is the case, can we expire or delete the LTPAToken cookie when the session expires? If so, what mechanism should we use?

Answer 4
You can manually perform a form-based logout (as described in the Information Center) to request that the LTPAToken cookie be destroyed in the web browser, but within WebSphere Application Server, there is no functionality to automatically perform the form-based logout when the session times out. This would have to be performed programmatically.

RELATED INFORMATION
 Federated Repository cache settings [https://www.ibm.com/support/knowledgecenter/en/SSAW57_8.5.5/com.ibm.websphere.nd.doc/ae/uwim_ldapperfsettings.html]
Authentication cache settings [https://www.ibm.com/support/knowledgecenter/en/SSAW57_8.5.5/com.ibm.websphere.nd.doc/ae/usec_sec_domains_cache.html]

Question:
Why isn't my LTPA token auto-renewing in Chrome? After using Maximo 7.6.0.8 from Chrome for a while (an hour?) my session became "dead". I could type in the "Find Navigation Item" box in the sidenav, but clicking on the selections went nowhere. Clicking on Sign Out didn't work, either. But there were loads of these errors in the logs for me. What's going wrong?

This dW Answers question is about an IBM document with the Title:
SECJ0371W Warning Message Additional Information

Answer:
When using single sign-on (SSO), the Security Cache will refresh from the LTPA Token. If your LTPA Token is also expired, then the user will be asked to re-login. Also, the cache timeout period is reset every time that entry is hit. So, if the entry is hit 9 minutes into the 10 minute timeout period, the clock is reset at that time. So, instead of timing out in another minute, it is now reset for another 10 minutes, then if it's hit again in that time, it will get extended again.

When using Local operating system for authentication, the user will be asked to login when the session times out, not the security cache.


IBM Format of XML-type ruleset parameters in SOAP messages with MTDS - United States XSD; schema; SOAP; web service TECHNOTE (FAQ)

QUESTION
 How to format the value of an XML-type ruleset parameter in the SOAP request to a Monitored Transparent Decision Service (MTDS) ?

CAUSE
As mentioned in the documentation for MTDS, XML parameters are represented by a String in the WSDL file.

ANSWER
The value of the parameter is the XML data corresponding to your input parameter XSD, either passed in a CDATA section or by escaping the XML special characters (replacing <, >, ", ' and & with <, >, ", ' and &).

For more information on transparent decision services, refer to section "Rule Execution Server > Introducing Rule Execution Server > Rule Execution Server basics > Transparent decision services and rule execution" of the JRules V7.1 documentation [http://publib.boulder.ibm.com/infocenter/brjrules/v7r1/index.jsp?topic=/com.ibm.websphere.ilog.jrules.doc/Content/Business_Rules/Documentation/_pubskel/JRules/ps_JRules_Global926.html].

RELATED INFORMATION
 JRules V7.0 doc on transparent decision services [http://publib.boulder.ibm.com/infocenter/brjrules/v7r0m3/topic/com.ibm.websphere.ilog.jrules.doc/Content/Business_Rules/Documentation/_pubskel/JRules/ps_JRules_Global801.html]
WODM V7.5 doc on transparent decision services [http://publib.boulder.ibm.com/infocenter/dmanager/v7r5/topic/com.ibm.dserver.res/Content/Business_Rules/_pubskel/Infocenter_Primary/ps_DS_Rule_Execution_Server1460.html]

Cross reference information Segment Product Component Platform Version Edition Business Integration IBM Operational Decision Manager Platform Independent 8.5, 8.0, 7.5

Question:
javax.xml.bind.UnmarshalException org.xml.sax.SAXParseException: The reference to entity must end with the ; delimiter.

After an upgrade from JRules to ODM we are receiving errors because of an ampersand in our data. This used to work before.

Caused by: javax.xml.bind.UnmarshalException
- with linked exception: [org.xml.sax.SAXParseException: The reference to entity "NIGHT" must end with the ; delimiter.

Answer: The value of the parameter is the XML data corresponding to your input parameter XSD, either passed in a CDATA section or by escaping the XML special characters (replacing <, >, ", ' and & with <, >, ", ' and &).


IBM Exported dates to IBM FileNet Content Engine are one day off in IBM Datacap Taskmaster Capture - United States FileNet P8; FNP8; Export; yesterday; GMT; UTC TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 Dates exported to IBM FileNet P8 Content Engine show yesterday's date when viewed by an IBM FileNet Content Engine client

CAUSE
IBM FileNet Content Engine stores all time stamps using UTC format. If a date is passed into IBM FileNet Content Engine with no time component then the time defaults to midnight UTC, which may indicate the prior date when converted back into local time.
Taskmaster does not convert or handle dates in GMT/UTC and thus any date values must be formatted by the application rules prior to export to IBM FileNet Content Engine

RESOLVING THE PROBLEM
Modify the date/time value into proper GMT/UTC format of YYYY-MM-DDTHH:MM[:SS] and then add a time offset to account for the GMT time difference, e.g. YYYY-MM-DDTHH:MM:SS-HH:MM, prior to export to FileNet P8.

The action IsFieldDateWithReformat from the Validations library can be called with a parameter of "s" (no quotation marks) to format a local date/time value to UTC; a GMT offset can be appended to a UTC value with any standard action such as rrSet from the rrunner library.

Example 1:

Description Field Value (Case A) Field Value (Case B) Data captured 05/31/2012 15:00 05/31/2012 IsFieldDateWithReformat(s) 2012-05-31T15:00:00 2012-05-31T00:00:00 rrSet(@F+-07:00,@F) 2012-05-31T15:00:00-07:00 2012-03-15T00:00:00-07:00 Here the initial field value is first transformed to UTC. The rrSet action is called to append the GMT offset "-07:00" to the field value.

Example 2: Description Field Value (Case A) Field Value (Case B) Data captured 05/31/2012 15:00 05/31/2012 IsFieldDateWithReformat(s) 2012-05-31T15:00:00 2012-05-31T00:00:00 rrSet(@F+@CHR(43)+07:00,@F) 2012-05-31T15:00:00+07:00 2012-03-15T00:00:00+07:00 Here the initial field value is first transformed to UTC. The rrSet action is called to append the GMT offset "+07:00" to the field value, @CHR is used to avoid conflict with the concatenation operator.

Note: IBM FileNet Content Engine may have a back end setting for Daylight Savings Time (DST), thus modifying the GMT offset to account for DST may not be necessary.

Cross reference information Segment Product Component Platform Version Edition Enterprise Content Management FileNet P8 Platform Content Engine Windows, AIX, HP-UX, Linux, Solaris 5.2, 5.1, 5.0, 4.5, 4.2, 4.1

Question:
Datetime export to FileNet  Hi there

I created an application in Datacap that export to FileNet a Datetime field. In FEM I have a property type of Datetime. I'm using the following to send value to FileNet:

FNP8_SetProperty ("DataEmissao,@DATE(dd/MM/yyyy)+@STRING( )+@TIME(HH:MM),Datetime")

The export works fine, but if I check the Datetime property in FEM I can see that the TIME was stored wrong, exactly 3 hours less.

e.g:

Current Datetime is: 19/08/2013 18:10

Value stored in FEM: 19/08/2013 15:10

Can someone help me? What I'm doing wrong?

Thank's

Answer:
Modify the date/time value into proper GMT/UTC format of YYYY-MM-DDTHH:MM[:SS] and then add a time offset to account for the GMT time difference, e.g. YYYY-MM-DDTHH:MM:SS-HH:MM, prior to export to FileNet P8.

The action IsFieldDateWithReformat from the Validations library can be called with a parameter of "s" (no quotation marks) to format a local date/time value to UTC; a GMT offset can be appended to a UTC value with any standard action such as rrSet from the rrunner library.


IBM Locked files encountered during Windows agent silent installation - United States locked files; silent; remote; installation; Windows TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 A silent installation of the Windows NT agent aborts due to locked files.

SYMPTOM
The Customer's AbortIBMTivoliMonitoring yyyymmdd hhmm.log (for example AbortIBMTivoliMonitoring20150409 1014.log) shows the following messages & errors.

4-9-2015 10:15:22 CheckLockedFiles - Search directory C:\IBM\ITM for locked files.
4-9-2015 10:15:22 CheckLockedFiles - File C:\IBM\ITM\InstSpbs\WINDOWS\ISSetup.dll is locked.
4-9-2015 10:15:22 File C:\IBM\ITM\InstSpbs\WINDOWS\ISSetup.dll could not be renamed, errors may occur.
4-9-2015 10:15:22 CheckLockedFiles - File C:\IBM\ITM\InstSpbs\WINDOWS\setup.exe is locked.
4-9-2015 10:15:22 File C:\IBM\ITM\InstSpbs\WINDOWS\setup.exe could not be renamed, errors may occur.
4-9-2015 10:15:22 CheckLockedFiles - Directory C:\IBM\ITM has locked files.
4-9-2015 10:15:22 CheckedLockedFiles - silent install processing
4-9-2015 10:15:22 CheckedLockedFiles - Check[C:\IBM\ITM\InstSpbs\silent_winos622_64bit_prod.txt] for Locked Files=continue
4-9-2015 10:15:22 CheckLockedFiles - Locked files not present.
4-9-2015 10:15:22 CheckLockedFiles - Directory C:\IBM\ITM - return TRUE
4-9-2015 10:15:22 Directory C:\IBM\ITM has locked files.
4-9-2015 10:15:22 Correct and launch setup again.
4-9-2015 10:15:22 Directory C:\IBM\ITM has locked files, unable to continue.
4-9-2015 10:15:22 SEVERE: ERROR - Install aborted.

CAUSE
A limitation for remote deployment and silent installations indicates:
A silent installation terminates if product files are locked. This behavior ensures that the installer does not overwrite product files that are currently running. The best practice is to shut down all components, including monitoring servers, portal server, and portal clients before you perform any product upgrade. This limitation only affects silent installations. Installations through the installation wizard is not affected.

ENVIRONMENT
Any Windows version

Any ITM component installed silently

DIAGNOSING THE PROBLEM
Look in <ITMHOME>\InstallITM for a file name with syntax similar to:
AbortIBMTivoliMonitoring<DATE TIME>.log

For example:
AbortIBMTivoliMonitoring20150409 1014.log

RESOLVING THE PROBLEM
Workaround: Use the following method to resolve the problem:
1. Search the installation log for instances of the CheckLockedFiles string. Locked files are listed at these places. Locked files are files that might need to be upgraded during an installation, and because they are in use (locked) the silent install terminates.

2. Identify the process that is locking the files.

3. Stop the process.

4. Prevent file locking by modifying the response file for installation file. This step is required when a silent installation has terminated.

a. Open the response file in a text editor. In many cases, the file in which you make this modification is named silent.txt. On Windows, the file to modify is the NT_Silent_Install.txt file that is located on the monitoring server.
b. Add the following line to the [INSTALLATION SECTION] area of your silent install response file:
Locked Files=continue
If you apply any other value or assign no value for this parameter, silent installations fail when locked files exist.
c. If Locked Files=continue is used in a silent install or remote deploy, the computer MUST be rebooted before ITM is brought up or another install is run. This is mandatory or the <ITMHOME> directory could become corrupt. If the <ITMHOME> directory becomes corrupt, all of ITM will have to be uninstalled and reinstalled.

5. Run the silent installation again.

Question:
Why does silent install abort indicating files are locked? Silent installs can fail reporting that there are locked files under the ITM installation directory on Windows platform. Why does this happen?

Example:

C:\IBM\ITM\InstallITM\
Abort IBM Tivoli Monitoring 20160203 1832.log

02-03-2016 18:37:10: File C:\IBM\ITM\TMAITM6\deploy.jar is locked.
02-03-2016 18:37:10: File C:\IBM\ITM\TMAITM6\deploy.jar could not be renamed, errors may occur.
02-03-2016 18:37:17: Directory C:\IBM\ITM has locked files.
02-03-2016 18:37:17: Correct and launch setup again.
02-03-2016 18:37:17: Directory C:\IBM\ITM has locked files, unable to continue.
02-03-2016 18:37:17: SEVERE: ERROR - Install aborted.

Answer:
A limitation for remote deployment and silent installations indicates:
A silent installation terminates if product files are locked. This behavior ensures that the installer does not overwrite product files that are currently running. The best practice is to shut down all components, including monitoring servers, portal server, and portal clients before you perform any product upgrade. This limitation only affects silent installations. Installations through the installation wizard is not affected.


IBM Failover to secondary node under MSCS and the queue manager will not start - United States HL083112 mqlpgrlg ZX000001 ExecCtrlrMain lpiRC_LOG_NOT_AVAILABLE mscs TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 You attempt to failover from the primary to secondary node under MSCS. Your WebSphere MQ queue manager fails to come up on the secondary node, and errors are generated.

SYMPTOM
The sequence seen in the FDC files show:

Probe Id :- HL083112
Component :- mqlpgrlg
Process Name :- D:\Programs\MQSeries\bin\amqzxma0.exe
Major Errorcode :- hrcE_MQLO_UNEXPECTED_OS_ERROR
MQM Function Stack
kpiStartup
apiStartup
almPerformReDoPass
hlgScanLogBegin
mqlpgrlg
xcsFFST

Probe Id :- ZX000001
Component :- ExecCtrlrMain
Process Name :- D:\Programs\MQSeries\bin\amqzxma0.exe
Major Errorcode :- xecF_E_UNEXPECTED_RC
Minor Errorcode :- lpiRC_LOG_NOT_AVAILABLE
Probe Description :- AMQ6118: An internal WebSphere MQ error has occurred
(7017)
Arith1 :- 28695 7017
MQM Function Stack
xcsFFST

CAUSE
This is caused by a logger failure at restart due to missing or damaged logs.

RESOLVING THE PROBLEM
Rename the file amqalchk.fil, which is found under mq\qmgrs\qmgrname\ on the shared drive (to something like amqalchk.fil_OLD); then restart the queue manager.

PRODUCT ALIAS/SYNONYM
 WMQ / MQ

Question: Why does the other instance of my multi-instance qmgr seem to hang after a failover? Queue manager will not start after failover.

Answer: Rename the file amqalchk.fil, which is found under mq\qmgrs\qmgrname\ on the shared drive (to something like amqalchk.fil_OLD); then restart the queue manager.


IBM Error when launching Scan task from Datacap Desktop. - United States Desktop; No data; Scan; VScan TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 Receiving the following error message when attempting to launch up Scan task from Datacap Desktop:
"This batch has no data to process. Aborting."

Then followed by this error:
"Unable to run queue."

DIAGNOSING THE PROBLEM
The panel for TravelDocs contained a value with all upper-case letter [eg. TRAVELDOCS], which caused the error to occur when attempting to launch the Scan task from Datacap Desktop

RESOLVING THE PROBLEM
The "Bind DCO type to panel" for Datacap Desktop is case-sensitive. Be sure the DCO name matches as it appears in Datacap Studio (both the spelling and case-sensitivity).

Logon to TMWeb client.

Go to Administrator tab

Select the VScan task from the Workflow.

Click Setup under Program.

Then change the value of the Panel to match what is in Datacap Studio. For example "TRAVELDOCS" to "TravelDocs"

Click Save

[/support/docview.wss?uid=swg21967312&aid=1] [/support/docview.wss?uid=swg21967312&aid=1]

[/support/docview.wss?uid=swg21967312&aid=2] [/support/docview.wss?uid=swg21967312&aid=2]
[/support/docview.wss?uid=swg21967312&aid=3] [/support/docview.wss?uid=swg21967312&aid=3]

Question:
VScan not working after migrating Datacap Application from 8.1 to 9.0.1 I have recently migrated one datacap application developed in Datacap 8.1 to Datacap 9.0.1. I followed the complete instruction provided in the link

http://www.ibm.com/support/knowledgecenter/SSZRWV_9.0.1/com.ibm.dc.develop.doc/dcadv001.htm

After migration, when I tried to execute the application using Datacap Desktop. I got errors that "This batch has no data to process. Aborting" and "Unable to run queue". I am attaching the screenshots of error. I am also attaching the DStudio rule's screenshot.

I have verified and configured all the required settings.

Please guide if someone has faced the similar issue and resolved it.

Answer: The "Bind DCO type to panel" for Datacap Desktop is case-sensitive. Be sure the DCO name matches as it appears in Datacap Studio (both the spelling and case-sensitivity).


IBM Cognos Report Studio in Tivoli Common Reporting Version 3.1 and later fix packs fail to launch on Internet Explorer Version 11 - United States jazzsm11relnotes; jazzsm1101relnotes; jazzsm1102relnotes; jazzsm1103relnotes; jazzsm1110relnotes; jazzsm1120relnotes; jazzsm1121relnotes; jazzsm1130relnotes TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 IBM® Cognos® Report Studio in Tivoli® Common Reporting Version 3.1 and later fix packs fail to launch on Internet Explorer Version 11

CAUSE
IBM Jazz for Service Management includes the Dashboard Application Services Hub service and the Tivoli Common Reporting service.
Dashboard Application Services Hub supports Internet Explorer v11 in full mode because bundled libraries like Dojo only support Internet Explorer v11 in full mode.
Whereas, the bundled version of Cognos Business Intelligence v10.2.2 within Tivoli Common Reporting supports Internet Explorer v11 in compatibility mode.
When launching Tivoli Common Reporting from Dashboard Application Services Hub, because of browser mode compatibility issues, Cognos Report Studio functionalities do not work as expected.

RESOLVING THE PROBLEM
To resolve this issue, access the following Tivoli Common Reporting dispatcher link:

https://JazzSM_hostname:port/tarf/servlet/dispatch

For example:
https://JazzSM_hostname:16311/tarf/servlet/dispatch

Question: Why I get pop-up message of "undefined" when accessing TCR 3.1.2.1 in IE 11? When I access Tivoli Common Reporting -> Launch -> Administration, will get repeated message window with content of "underfined". This happened only with IE11 and TCR 3.1.2.1

Answer:
To resolve this issue, access the following Tivoli Common Reporting dispatcher link:

https://JazzSM_hostname:port/tarf/servlet/dispatch


IBM HPDMG0759W error when creating the AMJRTE properties file - United States TAM; run-svrssl-config; svrssl; HPDMG0759W; AMJRTE TECHNOTE (TROUBLESHOOTING)

PROBLEM
When executing the "run-svrssl-config" task via the ConfigEngine to create the AMJRTE properties file, you receive the following error:

Command to run is: java com.tivoli.pd.jcfg.SvrSslCfg -action config -admin_id sec_master -admin_pwd ****** -appsvr_id myserverid -port 7223 -mode remote -policysvr <hostname>:7135:1 -authzsvr <hostname>:7136:1 -cfg_file C:\IBM\WebSphere\AppServer\java\jre/PdPerm.properties -key_file C:\IBM\WebSphere\AppServer\java\jre/lib/security/pdperm.ks
[java] Exception in thread "main"
[java] [
[java] HPDMG0759W The user name already exists in the registry.
[java] ]
[java] at com.tivoli.pd.jutil.bo.a(bo.java:98)

ENVIRONMENT
Configuring WebSphere® Portal 6.1 with Tivoli® Access Manager 6.0

DIAGNOSING THE PROBLEM

The user name referenced in the error message refers to the appsvr id used in the SvrSslCfg command. The value for this user name is set via the following parameter in wkplc_comp.properties:

wp.ac.impl.PDServerName

RESOLVING THE PROBLEM

To avoid the error, do one of the following steps before executing the run-svrssl-config task:

a) Use a unique value for wp.ac.impl.PDServerName

or

b) Run the following command manually from a command prompt on the portal server to remove the appsvr_id value from Tivoli Access Manager's repository:

java com.tivoli.pd.jcfg.SvrSslCfg -action unconfig-admin_id sec_master -admin_pwd ****** -appsvr_id myserverid -port 7223 -mode remote -policysvr <hostname>:7135:1 -authzsvr <hostname>:7136:1 -cfg_file C:\IBM\WebSphere\AppServer\java\jre/PdPerm.properties -key_file

RELATED INFORMATION
#Creating the AMJRTE properties file [http://publib.boulder.ibm.com/infocenter/wpdoc/v6r1m0/index.jsp?topic=/com.ibm.wp.ent.doc/security/cfg_tam_auth.html]

 *
 *

Question:
Why is an error seen while running run-svrssl-config?

Following error is seen while running run-svrssl-config ConfigEngine task:

     action-run-pdjrte-config-zos-wp.ac.impl:
     [validateHost] Validating hostname(s) in the following argument: tam001:7136:1,tam002:7136:2
          [echo] Command to run is: java com.tivoli.pd.jcfg.SvrSslCfg -action config -admin_id sec_master -admin_pwd ****** -appsvr_id myAppSvr -port 7223 -mode remote -policysvr
     tam001:7135:1,tam002:7135:2 -authzsvr tam001:7136:1,tam002:7136:2 -cfg_file /opt/WebSphere/AppServer/tivoli/tam/PdPerm.properties -key_file /opt/WebSphere/AppServer/tivoli/tam/pdperm.ks
          [java] Executing java with empty input string
          [java] Exception in thread "main"
          [java] [
          [java] HPDMG0759W The user name already exists in the registry.
          [java] ]
          [java] at com.tivoli.pd.jutil.ob.a(ob.java:40)
          [java] at com.tivoli.pd.jutil.ob.a(ob.java:66)

Answer:
To avoid the error, do one of the following steps before executing the run-svrssl-config task:

a) Use a unique value for wp.ac.impl.PDServerName

or

b) Run the following command manually from a command prompt on the portal server to remove the appsvr_id value from Tivoli Access Manager's repository:

java com.tivoli.pd.jcfg.SvrSslCfg -action unconfig-admin_id sec_master -admin_pwd ****** -appsvr_id myserverid -port 7223 -mode remote -policysvr <hostname>:7135:1 -authzsvr <hostname>:7136:1 -cfg_file C:\IBM\WebSphere\AppServer\java\jre/PdPerm.properties -key_file


IBM MustGather: Object Request Broker (ORB) problems with WebSphere Application Server - United States MustGather; MustGather; MustGather; ORB; Object Request Broker; ISA; collector; autopd; auto pd; MustGatherDocument TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 Collecting data for problems with the IBM WebSphere Application Server Object Request Broker component. Gathering this MustGather information before calling IBM support will help you understand the problem and save time analyzing the data.

RESOLVING THE PROBLEM

TAB NAVIGATION
 * Learning more [http://www.ibm.com/support/docview.wss?uid=swg21245077]
 * Troubleshooting [http://www.ibm.com/support/docview.wss?uid=swg21237101]
 * Collecting data- selected tab,

Collecting data for problems with the IBM WebSphere Application Server Object Request Broker component. Gathering this MustGather information before calling IBM support will help you understand the problem and save time analyzing the data..

COLLECTING DATA MANUALLY

Object Request Broker specific MustGather information  1.  Where does the problem occur? Between what components?

 2.  What is your topology?

 3.  What are the symptoms noticed?

 4.  How do you recover from this problem?

 5.  What are the hostnames of the Client and the Application Servers?

 6.  How often does this problem occur?

 7.  Is there a firewall installed between the failing components?

 8.  Can you successfully ping the server from the remote client? Can you ping the client from the remote server?

 9.  Has this problem always occurred or has it just started to occur? If it just started, what changes were made?

 10. Clear out the logs in the install_root/logs directory, then recreate the problem.

 11. Collect the following files:  * The newly created logs.

      * Answers to the preceding questions.

      * For releases of WebSphere Application Server versions 5.0 and 6.0  * collector.[sh/bat] output

      * Any additional information you think might relate (topology, symptoms, and so on) to IBM.

        Note: Additional ORB, Security, or WLM traces might be required.

Additional MustGather information for ORB interoperability problems

 1.  What third-party ORB are you trying to use?

 2.  What version is the third-party ORB using?

 3.  What language is the third-party ORB using? (C++ or Java)

 4.  What platform is the third-party ORB running on?

 5.  What platform is WebSphere Application Server running on?

 6.  Does the problem or error occur consistently or randomly?

 7.  Is the problem reproducible? If so, what are the steps?

 8.  Is WebSphere Application Server being used as the server or client to the third-party ORB?

 9.  Has this worked before, or is this a new configuration?

 10. Have you tried using the approach recommended in the CORBA Interop samples?

 11. Where was the Interface Definition Language (IDL) compiled (what tool was used)?

     Note: See the WebSphere Application Server detailed system requirements [http://www.ibm.com/support/docview.wss?uid=swg27006921] for the information related to the third party ORB Supported/Tested, then select WebSphere Version > Server Type > Search on third-party ORB in Software Requirements List.

A collector output is required for the WebSphere Application Server support team to troubleshoot an ORB issue. By providing the collector output, your configuration can be reviewed to help get a better understanding of your topology and settings.

 * Detailed instructions on how to run the collector program can be found at the following link:

https://www.ibm.com/support/knowledgecenter/SSEQTP_8.5.5/com.ibm.websphere.nd.doc/ae/ttrb_runct.html [https://www.ibm.com/support/knowledgecenter/SSEQTP_8.5.5/com.ibm.websphere.nd.doc/ae/ttrb_runct.html]

Make sure you do not run the collector program from within the WebSphere Application Server product installation root directory. This will lead to an error. Make a working directory where you can start the collector program.

Once you have run the collector program from the dmgr, upload the collector.jar file that is created.

If specific ORB traces have been requested by the Application Server support team, use the following instructions:

NOTE: In most cases, support is going to need a matching client and server side trace to troubleshoot the issue. In some cases, they may even need traces from the nodeagent.

 * WebSphere Application Server V6.1, V7.0, V8.0, and V8.5 ORB trace instructions
   You can review the following video that walks you through setting up the ORB trace in the Administrative Console. It goes through each step listed below to make sure the ORB trace is enabled correctly.

    1.  From the Administrative Console, select Servers > Application Servers > server_name > Change Log Details Levels.

    2.  Remove any previous entries in the text field type the following:

        *=info:ORBRas=all

    3.  Apply and save changes.

    4.  Select Servers > Application Servers > server_name > Diagnostic Trace Service.

    5.  Change the Maximum Number of Historical Files to 10 and maximum file size to 50mb

    6.  Apply and save changes.

    7.  Enabling Comm Trace:

        Application Server
        From the Administrative Console, Select Servers > Application Servers > server_name > Container Services > ORB Service. Select the Orb Tracing check box to enable Comm Tracing.

        Node Agent
        From the Administrative Console, select System Administration >Node Agent > nodeagent > ORB Service. Select the Orb Tracing check box to enable Comm Tracing.

        Deployment Manager
        From the Administrative Console, Select System Administration > Deployment Manager > ORB Service. Select the Orb Tracing check box to enable Comm Tracing.

        NOTE: You will need to do a server restart for the Comm Tracing to be captured in the trace.log file. You can also leave the Orb Tracing check box checked permanently in case you run into another ORB issue in the future. That way, you don't have to do another server restart for the trace to be captured. Leaving the Orb Tracing check box checked won't log any data to a trace log unless you have the ORBRas=all trace string enabled (Step 2 above). This means it won't cause any performance issues or affect anything else in the server.
    8.  Apply and save changes.

    9.  Restart the sever and recreate the problem

    10. Collect the following data:

        profile_root/logs/server_name/trace.log

    *
    * profile_root
    * /logs/ffdc folder

    *

    * NOTE:
    *
    * date
    *
    * time
    *
    *

 * Stand Alone Java Client ORB Trace Instructions  1. Start the client program with the "-D" arguments to specify the trace settings

       -Dcom.ibm.CORBA.Debug=true -Dcom.ibm.CORBA.CommTrace=true -Dcom.ibm.CORBA.Debug.Output=client.log

    2. The ORB trace output is captured in the path pointed by com.ibm.CORBA.Debug.Output.

       If the com.ibm.CORBA.Debug.Output parameter is not specified, the ORB trace output is captured in a unique trace file named orbtrc.<timestamp>.txt in the current directory of execution.

    3. Collect the following file:

       orbtrc.<timestamp>.txt

 * J2EE Client Trace Instructions  1. Start the launchClient script with the following arguments to enable the trace:

       install_root/bin/launchClient.sh <ear_file> -JVMOptions="-Dcom.ibm.CORBA.Debug=true -Dcom.ibm.CORBA.CommTrace=true" -CCtrace=ORBRas=all -CCtracefile=orbtrace.txt -CCtraceMode=basic

       Note: For Windows installations, use launchClient.bat instead of launchClient.sh

    2. The ORB trace output is captured in a unique trace file named orbtrace.txt in the current directory of execution.

    3. Collect the following file:

       orbtrace.txt

 * How to check IBM® Java™ ORB build version in WebSphere® Application Server.

 *  <washome>/java/bin/java -Xbootclasspath/p:<washome>/java/jre/lib/ext/ibmorb.jar com.ibm.rmi.util.Version

 * Follow instructions to send diagnostic information to IBM support [http://www.ibm.com/support/docview.wss?uid=swg21153852] [http://www.ibm.com/support/docview.wss?rs=180&uid=swg21153852]

For a listing of all technotes, downloads, and educational materials specific to the ORB component, search the WebSphere Application Server support site [http://www.ibm.com/support/entry/portal/Overview/Software/WebSphere/WebSphere_Application_Server].

Related information [http://www.ibm.com/support/docview.wss?uid=swg21153852]
Submitting information to IBM support [http://www.ibm.com/support/docview.wss?uid=swg21153852]
Steps to getting support for WebSphere Application Server [http://www.ibm.com/developerworks/websphere/support/appserver_support.html]
MustGather: Read first for WebSphere Application Server [http://www.ibm.com/support/docview.wss?uid=swg21145599]
Troubleshooting guide for WebSphere Application Server [http://www.ibm.com/support/docview.wss?uid=swg27005324]

EXCHANGING DATA WITH IBM SUPPORT
To diagnose or identify a problem, it is sometimes necessary to provide Technical Support with data and information from your system. In addition, Technical Support might also need to provide you with tools or utilities to be used in problem determination. You can submit files using one of following methods to help speed problem diagnosis:

 * Service Request (SR)
 * E-mail
 * FTP to the Enhanced Customer Data Repository (ECuRep)

Instructions for exchanging information with IBM Support [http://www.ibm.com/support/docview.wss?uid=swg21153852]

READ FIRST AND RELATED MUSTGATHERS
MustGather: Read first for WebSphere Application Server [http://www.ibm.com/support/docview.wss?uid=swg21145599]

 Classloader problem [http://www.ibm.com/support/docview.wss?uid=swg21196187] Security Problem [http://www-01.ibm.com/support/docview.wss?uid=swg21470063] JNDI Problem [http://www.ibm.com/support/docview.wss?uid=swg21143296] JTS Problem [http://www.ibm.com/support/docview.wss?uid=swg21153216] Session Management Problem [http://www.ibm.com/support/docview.wss?uid=swg21192604] Workload Management Problem [http://www.ibm.com/support/docview.wss?uid=swg21052165]

RELATED INFORMATION
 Recording your screen to share with IBM Support [https://www.ibm.com/developerworks/community/blogs/IBMElectronicSupport/entry/recording_your_screen_to_share_with_support?lang=en]

Cross reference information Segment Product Component Platform Version Edition Application Servers Runtimes for Java Technology Java SDK AIX, HP-UX, Linux, Solaris, Windows 8.0, 7.1, 7.0, 6.1, 6.0.2, 6.0 Application Servers WebSphere Application Server Object Request Broker (ORB) AIX, HP-UX, Linux, Solaris, Windows 9.0, 8.5.5, 8.5, 8.0, 7.0, 6.1 Base, Network Deployment

Question: How to check IBM Java ORB build version in WebSphere Application Server? Just a simple question: How to check IBM Java ORB build version in WebSphere Application Server?

Answer: <washome>/java/bin/java -Xbootclasspath/p:<washome>/java/jre/lib/ext/ibmorb.jar com.ibm.rmi.util.Version


IBM Security Bulletin: Information disclosure in WebSphere Application Server (CVE-2017-1681) - United States  SECURITY BULLETIN

SUMMARY
 There is a potential information disclosure vulnerability in WebSphere Application Server.

VULNERABILITY DETAILS

CVEID: CVE-2017-1681 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1681]
DESCRIPTION: IBM WebSphere Application Server (IBM Liberty for Java for Bluemix 3.15) could allow a local attacker to obtain sensitive information, caused by improper handling of application requests, which could allow unauthorized access to read a file. IBM X-Force ID: 134003.
CVSS Base Score: 4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/134003 [https://exchange.xforce.ibmcloud.com/vulnerabilities/134003] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

AFFECTED PRODUCTS AND VERSIONS
This vulnerability affects the following versions and releases of IBM WebSphere Application Server:

 * Liberty
 * Version 9.0
 * Version 8.5
 * Version 8.0
 * Version 7.0

REMEDIATION/FIXES
The recommended solution is to apply the interim fix, Fix Pack or PTF containing APARs PI88642 for each named product as soon as practical.

For WebSphere Application Server Liberty with fixpack levels prior to 17.0.0.3:
· Upgrade to minimal fix pack levels as required by interim fix and then apply Interim Fix PI88642 [http://www-01.ibm.com/support/docview.wss?uid=swg24044506] [http://www-01.ibm.com/support/docview.wss?uid=swg24044155] [http://www-01.ibm.com/support/docview.wss?uid=swg24043596] [http://www-01.ibm.com/support/docview.wss?uid=swg24042712] [http://www-01.ibm.com/support/docview.wss?uid=swg24041604] [http://www-01.ibm.com/support/docview.wss?uid=swg24041394] [http://www-01.ibm.com/support/docview.wss?uid=swg24042513] [http://www-01.ibm.com/support/docview.wss?uid=swg24041604] [http://www-01.ibm.com/support/docview.wss?uid=swg24041394]
--OR--
· Apply Liberty Fix Pack 17.0.0.3 or later.

For WebSphere Application Server traditional and WebSphere Application Server Hypervisor Edition:

For V9.0.0.0 through 9.0.0.6:
· Upgrade to minimal fix pack levels as required by interim fixes and then apply Interim Fix PI88642 [http://www-01.ibm.com/support/docview.wss?uid=swg24044506] [http://www-01.ibm.com/support/docview.wss?uid=swg24044155] [http://www-01.ibm.com/support/docview.wss?uid=swg24043596] [http://www-01.ibm.com/support/docview.wss?uid=swg24042712] [http://www-01.ibm.com/support/docview.wss?uid=swg24041604] [http://www-01.ibm.com/support/docview.wss?uid=swg24041394] [http://www-01.ibm.com/support/docview.wss?uid=swg24042513] [http://www-01.ibm.com/support/docview.wss?uid=swg24041604] [http://www-01.ibm.com/support/docview.wss?uid=swg24041394] [http://www-01.ibm.com/support/docview.wss?uid=swg24044155] [http://www-01.ibm.com/support/docview.wss?uid=swg24044154]
--OR--
· Apply Fix Pack 9.0.0.7 or later.

For V8.5.0.0 through 8.5.5.12:
· Upgrade to minimal fix pack levels as required by interim fixes and then apply Interim Fix PI88642 [http://www-01.ibm.com/support/docview.wss?uid=swg24044506]
--OR--
· Apply Fix Pack 8.5.5.13 or later.

For V8.0.0.0 through 8.0.0.14:
· Upgrade to a minimal fix pack levels as required by interim fix and then apply Interim Fix PI88642 [http://www-01.ibm.com/support/docview.wss?uid=swg24044506] [http://www-01.ibm.com/support/docview.wss?uid=swg24043596] [http://www-01.ibm.com/support/docview.wss?uid=swg24042712] [http://www-01.ibm.com/support/docview.wss?uid=swg24041604] [http://www-01.ibm.com/support/docview.wss?uid=swg24041394] [http://www-01.ibm.com/support/docview.wss?uid=swg24042513] [http://www-01.ibm.com/support/docview.wss?uid=swg24041604] [http://www-01.ibm.com/support/docview.wss?uid=swg24041394]
--OR--
· Apply Fix Pack 8.0.0.15 or later.

For V7.0.0.0 through 7.0.0.43:
· Upgrade to a minimal fix pack levels as required by interim fix and then apply Interim Fix PI88642 [http://www-01.ibm.com/support/docview.wss?uid=swg24044506] [http://www-01.ibm.com/support/docview.wss?uid=swg24043596] [http://www-01.ibm.com/support/docview.wss?uid=swg24042712] [http://www-01.ibm.com/support/docview.wss?uid=swg24041604] [http://www-01.ibm.com/support/docview.wss?uid=swg24041394] [http://www-01.ibm.com/support/docview.wss?uid=swg24042513] [http://www-01.ibm.com/support/docview.wss?uid=swg24041604] [http://www-01.ibm.com/support/docview.wss?uid=swg24041394]
--OR--
· Apply Fix Pack 7.0.0.45 or later.

GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

IMPORTANT NOTE
 IBM strongly suggests that all System z customers be subscribed to the System z Security Portal to receive the latest critical System z security and integrity service. If you are not subscribed, see the instructions on the System z Security web site [http://www.ibm.com/systems/z/solutions/security_subintegrity.html]. Security and integrity APARs and associated fixes will be posted to this portal. IBM suggests reviewing the CVSS scores and applying all security or integrity fixes as soon as possible to minimize any potential risk.

REFERENCES
Complete CVSS v3 Guide [http://www.first.org/cvss/user-guide]
On-line Calculator v3 [http://www.first.org/cvss/calculator/3.0]

RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/psirt]

CHANGE HISTORY
 29 January 2018: original document published
08 February 2018: updated CVSS score, changed from 5.3 to 4.0

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

RELATED INFORMATION
 A Japanese translation is available [http://www.ibm.com/support/docview.wss?uid=swg22013132]

Cross reference information Segment Product Component Platform Version Edition Application Servers WebSphere Application Server Hypervisor Edition Application Servers WebSphere Application Server Liberty Core

Question: Help with Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with WebSphere Service Registry and Repository (CVE-2017-1681) I need to understand details regarding Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with WebSphere Service Registry and Repository (CVE-2017-1681). Is WAS Liberty affected?

Answer:
This vulnerability affects the following versions and releases of IBM WebSphere Application Server:

 * Liberty


IBM Security Bulletin: Multiple Security Vulnerabilities fixed in IBM WebSphere Application Server 8.5.5.6 - United States  SECURITY BULLETIN

SUMMARY
 Cross reference list for security vulnerabilites fixed in IBM WebSphere Application Server 8.5.5.6, IBM WebSphere Application Server Hypervisor 8.5.5.6 and IBM WebSphere Application Server Liberty Profile 8.5.5.6.

VULNERABILITY DETAILS
CVEID: CVE-2015-0226 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0226]
DESCRIPTION: Apache WSS4J could allow a remote attacker to obtain sensitive information, caused by Bleichenbacher's attack on XML Encryption. By sending a specially-crafted message, an attacker could exploit this vulnerability to decrypt the key and obtain sensitive information.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100836 [https://exchange.xforce.ibmcloud.com/vulnerabilities/100836] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)
AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:

Version 8.5 Liberty Profile

Remediation/Fixes: The recommended solution is to apply the Interim Fix, Fix Pack, or PTF for each named product as soon as practical.

Fix:
Apply an Interim Fix [http://www-01.ibm.com/support/docview.wss?uid=swg24039403], Fix Pack or PTF [https://www-304.ibm.com/support/docview.wss?rs=180&uid=swg27004980] containing this APAR PI36866, as noted below:

For IBM WebSphere Application Server Liberty profile:

For V8.5.5.2 through 8.5.5.5: Apply Fix Pack 6 (8.5.5.6), or later.
-- OR Apply Interim Fix PI36866 [http://www-01.ibm.com/support/docview.wss?uid=swg24040191]

Workaround(s): None known
Mitigation(s): None known

CVE ID: CVE-2015-1885 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1885] (APAR PI33202 and PI36211)

DESCRIPTION: WebSphere Application Server Full Profile and Liberty Profile could allow a remote attacker to gain elevated privileges on the system when OAuth grant type of password is used.

CVSS:
CVSS Base Score: 9.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/101255 [https://exchange.xforce.ibmcloud.com/vulnerabilities/101255] for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:N/C:C/I:C/A:C)

AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected: Version 8.5 Full Profile and Liberty Profile Version 8.0 Version 7.0

Remediation/Fixes: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical.

Fix:
Apply an Interim Fix, Fix Pack or PTF [https://www-304.ibm.com/support/docview.wss?rs=180&uid=swg27004980] containing this APAR PI36211 for Full Profile and PI33202 for Liberty Profile, as noted below:

For IBM WebSphere Application Server

For V8.5.0.0 through 8.5.5.5 Full Profile: Apply Interim Fix PI36211 [http://www-01.ibm.com/support/docview.wss?uid=swg24039602]
-- OR Apply Fix Pack 6 (8.5.5.6), or later. After the fix pack is installed, the fix will not be active until the installed OAuth ear, WebSphereOauth20SP.ear, is updated from the (WAS_HOME)/installableApps directory.

For V8.5.0.0 through 8.5.5.4 Liberty Profile: Apply Interim Fix PI33202 [http://www-01.ibm.com/support/docview.wss?uid=swg24039594] [http://www-01.ibm.com/support/docview.wss?uid=swg24039594] [http://www-01.ibm.com/support/docview.wss?uid=swg24039403]
-- OR Apply Fix Pack 5 (8.5.5.5), or later.

For V8.0.0.0 through 8.0.0.10: Apply Interim Fix PI36211 [http://www-01.ibm.com/support/docview.wss?uid=swg24039602]
-- OR Apply Fix Pack 11 (8.0.0.11), or later. After the fix pack is installed, the fix will not be active until the installed OAuth ear, WebSphereOauth20SP.ear, is updated from the (WAS_HOME)/installableApps directory.

For V7.0.0.0 through 7.0.0.37: Apply Interim Fix PI36211 [http://www-01.ibm.com/support/docview.wss?uid=swg24039602]
-- OR Apply Fix Pack 39 (7.0.0.39), or later. After the fix pack is installed, the fix will not be active until the installed OAuth ear, WebSphereOauth20SP.ear, is updated from the (WAS_HOME)/installableApps directory.

Workaround(s): None known
Mitigation(s): None known

CVEID: CVE-2015-0250 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0250]
DESCRIPTION: Apache Batik could allow a remote attacker to obtain sensitive information. By persuading a victim to open a specially-crafted SVG file, an attacker could exploit this vulnerability to reveal files and obtain sensitive information.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101614 [https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101614] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected: Version 8.5 Full Profile Version 8 Version 7 Version 6.1

Remediation/Fixes: The recommended solution is to apply the Interim Fix, Fix Pack or PTF for each named product as soon as practical.

Fix:
Apply an Interim Fix [http://www-01.ibm.com/support/docview.wss?uid=swg24039403], Fix Pack or PTF [https://www-304.ibm.com/support/docview.wss?rs=180&uid=swg27004980] containing this APAR PI39768 or PI49437, as noted below:

For IBM WebSphere Application Server Full profile and IBM WebSphere Application Server Hypervisor Edition

For V8.5.0.0 through 8.5.5.5: Apply Fix Pack 6 (8.5.5.6), or later.
-- OR Apply Interim Fix PI39768 [http://www-01.ibm.com/support/docview.wss?uid=swg24040442]

For V8.0.0.0 through 8.0.0.10: Apply Fix Pack 11 (8.0.0.11), or later. [http://www-01.ibm.com/support/docview.wss?uid=swg21693751]
-- OR Apply Interim Fix PI39768 [http://www-01.ibm.com/support/docview.wss?uid=swg24040442]

For V7.0.0.0 through 7.0.0.37: Apply Fix Pack 39 (7.0.0.39), or later. [https://www-304.ibm.com/support/docview.wss?uid=swg21693757]
-- OR Apply Interim Fix PI49437 [http://www-01.ibm.com/support/docview.wss?uid=swg24041163] [http://www-01.ibm.com/support/docview.wss?uid=swg24040442]

For V6.1.0.0 through 6.1.0.47: Apply Fix Pack 47 (6.1.0.47), or later and then apply Interim Fix PI49437 [http://www-01.ibm.com/support/docview.wss?uid=swg24041163]

Workaround(s): None known
Mitigation(s): None known

CVEID: CVE-2015-1927 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1927]
DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to gain elevated privileges on the system, caused by an application not having the correct serveServletsbyClassname setting. By a developer not setting the correct property, an attacker could exploit this vulnerability to gain unauthorized access.
CVSS Base Score: 6.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/102872 [https://exchange.xforce.ibmcloud.com/vulnerabilities/102872] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P)

AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected: Version 8.5 Full Profile and Liberty Profile Version 8 Version 7

Remediation/Fixes: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical.

Fix:
Apply an Interim Fix [http://www-01.ibm.com/support/docview.wss?uid=swg24039403], Fix Pack or PTF [https://www-304.ibm.com/support/docview.wss?rs=180&uid=swg27004980] containing this APAR PI31622, as noted below:

Please Note:This APAR has changed the default value of the WebContainer custom property com.ibm.ws.webcontainer.disallowServeServletsByClassname from false to true so that no security threat could occur. Prior to this change, it was up to the developer to remember to change the custom property to true before deploying into production.

Property Name: com.ibm.ws.webcontainer.disallowServeServletsByClassname
Description: If set to true, disallows the use of serveServletsByClassnameEnabled at the application server level, overriding any setting of serveServletsByClassnameEnabled at the application level. This property affects all applications.
Values: true(default)/false

If you need to change the value please refer to the the following technote for instructions on enabling WebContainer custom properties:

Full Profile: http://www-01.ibm.com/support/docview.wss?uid=swg21284395 [http://www-01.ibm.com/support/docview.wss?uid=swg21284395]
Liberty Profile: http://www-01.ibm.com/support/docview.wss?uid=swg21597753 [http://www-01.ibm.com/support/docview.wss?uid=swg21597753]

For IBM WebSphere Application Server Full profile, IBM WebSphere Application Server Liberty Profile and IBM WebSphere Application Server Hypervisor Edition

For V8.5.0.0 through 8.5.5.5: Apply Fix Pack 6 (8.5.5.6), or later.
-- OR Apply Interim Fix PI31622 [http://www-01.ibm.com/support/docview.wss?uid=swg24040348]

For V8.0.0.0 through 8.0.0.10: Apply Fix Pack 11 (8.0.0.11), or later. [http://www-01.ibm.com/support/docview.wss?uid=swg21693751]
-- OR Apply Interim Fix PI31622 [http://www-01.ibm.com/support/docview.wss?uid=swg24040348]

For V7.0.0.0 through 7.0.0.37: Apply Fix Pack 39 (7.0.0.39), or later. [https://www-304.ibm.com/support/docview.wss?uid=swg21693757]
-- OR Apply Interim Fix PI31622 [http://www-01.ibm.com/support/docview.wss?uid=swg24040348]

Workaround(s): Set the custom property com.ibm.ws.webcontainer.disallowServeServletsByClassName to true
Mitigation(s): None known

CVEID: CVE-2015-1936 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1936]
DESCRIPTION: IBM WebSphere Application Server Administrative console could allow a remote authenticated attacker to hijack a user's session when Security is not enabled. An attacker could exploit this vulnerability using the JSESSIONID parameter to gain access to another user's session.
CVSS Base Score: 4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/103108 [https://exchange.xforce.ibmcloud.com/vulnerabilities/103108] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N)

AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected: Version 8.5 Full Profile Version 8

Remediation/Fixes: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical.

Fix:
Apply an Interim Fix [http://www-01.ibm.com/support/docview.wss?uid=swg24039403], Fix Pack or PTF [https://www-304.ibm.com/support/docview.wss?rs=180&uid=swg27004980] containing this APAR PI37230, as noted below:

For IBM WebSphere Application Server and IBM WebSphere Application Server Hypervisor Edition:

For V8.5.0.0 through 8.5.5.5: Apply Fix Pack 6 (8.5.5.6), or later.
-- OR Apply Interim Fix PI37230 [http://www-01.ibm.com/support/docview.wss?uid=swg24040347]

For V8.0.0.0 through 8.0.0.11: Apply Fix Pack 12 (8.0.0.12), or later. [http://www-01.ibm.com/support/docview.wss?uid=swg21693751]
-- OR Apply Interim Fix PI37230 [http://www-01.ibm.com/support/docview.wss?uid=swg24040347]

Workaround(s): None known
Mitigation(s): None known

CVEID: CVE-2015-1946 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1946]
DESCRIPTION: IBM WebSphere Application Server 8.5 and IBM WebSphere Virtual Enterprise 7.0 could allow a local attacker to gain elevated privileges on the system cause by the user roles not being handled properly.
CVSS Base Score: 4.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/103201 [https://exchange.xforce.ibmcloud.com/vulnerabilities/103201] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:M/Au:S/C:P/I:P/A:P)

AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected: Version 8.5 IBM WebSphere Application Server Version 7.0 IBM WebSphere Virtual Enterprise on WebSphere Application Server Version 7 and Version 8

Remediation/Fixes: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical.

Fix:
Apply an Interim Fix [http://www-01.ibm.com/support/docview.wss?uid=swg24039403], Fix Pack or PTF [https://www-304.ibm.com/support/docview.wss?rs=180&uid=swg27004980] containing this APAR PI35180, as noted below:

For IBM WebSphere Application Server

For V8.5.0.0 through 8.5.5.5: Apply Fix Pack 6 (8.5.5.6), or later.
-- OR Apply Interim Fix PI35180 [http://www-01.ibm.com/support/docview.wss?uid=swg24040235]

For IBM WebSphere Virtual Enterprise using WebSphere Application Server V7.0 and V8.0: Apply WebSphere Virtual Enterprise Fix Pack 6 (7.0.0.6) or later.

Workaround(s): None known
Mitigation(s): None known

Other APARs shipped with 8.5.5.6 are included in the security bulletins below:
PI33012 Security Bulletin for Dojo Toolkit Vulnerability [http://www-01.ibm.com/support/docview.wss?uid=swg21697284]
PI36563 Security Bulletin for RSA Export Keys for WebSphere Application Server [http://www-01.ibm.com/support/docview.wss?uid=swg21698613]
PI36563 Security Bulletin for RC4 Stream Cipher for WebSphere Application Server [http://www-01.ibm.com/support/docview.wss?uid=swg21701503]
PI38302 Security Bulletin for Management Port for WebSphere Application Server [http://www-01.ibm.com/support/docview.wss?uid=swg21883573]
PI36417 Security Bulletin for RSA Export Keys for IBM HTTP Server [http://www-01.ibm.com/support/docview.wss?uid=swg21698959]
PI34229 Security Bulletin for RC4 Stream Cipher for IBM HTTP Server [http://www-01.ibm.com/support/docview.wss?uid=swg21701072]

GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

IMPORTANT NOTE
 IBM strongly suggests that all System z customers be subscribed to the System z Security Portal to receive the latest critical System z security and integrity service. If you are not subscribed, see the instructions on the System z Security web site [http://www.ibm.com/systems/z/solutions/security_subintegrity.html]. Security and integrity APARs and associated fixes will be posted to this portal. IBM suggests reviewing the CVSS scores and applying all security or integrity fixes as soon as possible to minimize any potential risk.

REFERENCES
Complete CVSS v2 Guide [http://www.first.org/cvss/v2/guide]
On-line Calculator v2 [http://nvd.nist.gov/CVSS-v2-Calculator]

RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/psirt]

CHANGE HISTORY
 26 June 2015: original document published
29 June 2015: fix serveservlets custom property name and add workaround
30 June 2015: fix serveservlets custom property
16 July 2015: added additional links to ifixes
13 August 2015: added additonal link to ifixes
2 September 2015: updated fix pack dates and level
13 November 2015: updated interim fix PI39768 with PI49437

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Cross reference information Segment Product Component Platform Version Edition Application Servers WebSphere Application Server Hypervisor Edition Application Servers WebSphere Virtual Enterprise

Question: Where can I find information on security issues addressed in WAS fix pack 8.5.5.6? I am planning to upgrade to WAS fix pack 8.5.5.6 and would like to know what security vulnerabilities, if any, are addressed in this fix pack.

Answer: Cross reference list for security vulnerabilites fixed in IBM WebSphere Application Server 8.5.5.6, IBM WebSphere Application Server Hypervisor 8.5.5.6 and IBM WebSphere Application Server Liberty Profile 8.5.5.6.


IBM DOORS module fails to open in exclusive edit mode results in error "unable to open module ...no such file or directory" - United States missing session file; file not found; can not open module; open module exclusive edit fails; PM50525 TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 Attempts to open a module exclusive edit in IBM Rational DOORS result in the error "DOORS report
Unable to open module '/A Project/Requirements' No such file or directory".

SYMPTOM
A module with a large number of sections is used mostly in shareable edit mode.

You can open the module Read-only , or Shareable-Edit; but not in exclusive edit.

Steps to reproduce:

 1. Login to DOORS

 2. Click the Project, or folder, icon that contains the module

 3. Click the module icon in the DOORS Explorer window

 4. Click File > Open> Exclusive Edit (Ctrl + E)

Expected result: The module should open in Exclusive edit mode.

Actual result: The module will not open in exclusive edit module; however it will open in read only mode, or shareable edit mode. If you attempt to check the database integrity for issue the module is not flagged for any problems.

The full error message is as follows:

DOORS report
Unable to open module '/A Project/Requirements' No such file or directory"
C:\Program Files (x86)\IBM\Rational\DOORS\9.5\data\v6data\20\m00000021.mod\current.ver\s1000005.dtc

image

[/support/docview.wss?uid=swg21511831&aid=1] [/support/docview.wss?uid=swg21511831&aid=1]

CAUSE
 This issue has been identified as a product defect under APAR PM50525 [http://ibm.com/support/docview.wss?uid=swg1PM31236].

RESOLVING THE PROBLEM
This error indicates that a user session file is corrupted on the database server.

This defect is resolved in IBM Rational DOORS Version 9.4.0.1 [http://www-01.ibm.com/support/docview.wss?uid=swg27036720#9401]

WORKAROUND:

the following options can be used to correct this problem:

 * Retrieve the missing file from system backup and insert it into the module current.ver directory

   The advantage of inserting the missing session file is you do not need to restart the database server.

Warning these two option should only be performed by Rational Support. Modifications to the files in your DOORS database could result is data corruption and jeapordize your DOORS database. Send the session.ixc file to support for repair

From the module directory listed in the error message provide support the file session.ixc
Choosing to have support repair the session index file requires you to have all users log out
and shut down the DOORS database server until the repaired file is returned and inserted
to replace the existing data file for the module.

Create a replacement session file
From the module directory listed in the error message provide support the file session.ixc
Adjacent session files will be required in order to to create the replacement.
Your support engineer will identify these files from the session index file.
No work can be performed in the effected module until the replacement session file is restored
for the effected module.

Note: Generally the repair is only required for one user session file. However in circumstances where DOORS reports a missing session file for a module- the event that caused this may have effected session files for other users connected to the module. For this situation you may need to perform a successive repair to the index file.

Question: Cannot open module in exclusive edit - (no such file or directory) I have a module, that I can open normally, but when I try to open it in Exclusive Edit it tells me that "no such file or directory"  How do I solve this?

Answer: This defect is resolved in IBM Rational DOORS Version 9.4.0.1


IBM Late breaking updates to DataPower 7.5 documentation - United States  NEWS

ABSTRACT

The version 7.5 documentation for IBM DataPower Gateway is not the latest available information. This document covers late breaking updates that are not in IBM Knowledge Center.

Last updated, October 2017.

CONTENT
The late breaking updates in this document apply to DataPower Gateway version 7.5 documentation.

To access specific updates, click the appropriate link:  * Upgrade
 *
 * Installation
 *
 * GatewayScript
 *
 * File management
 *
 * Monitors

To view the change history of this document, see Change history

The corrections in the following sections apply to DataPower Gateway version 7.5 in IBM Knowledge Center.

Upgrade  *
 *  Disabled diffie-hellman-group-exchange-sha1 and diffie-hellman-group1-sha1 algorithms by default. Disabled MD5-based MAC algorithms. Limited DH-GEX to 4096 bits for Cisco devices.
 *
 *
 * enable-legacy-kex yes
 *
 *  The enable-legacy-kex command for the SSH server profile in available in 7.5.2.0. The enable-legacy-kex command for the SSH client profile is available in 7.5.2.7.
 *
 *
 *  Default cipher suites  * chacha20-poly1305@openssh.com (CHACHA20-POLY1305_AT_OPENSSH.COM)
    *
    * aes128-ctr (AES128-CTR)
    *
    * aes192-ctr (AES192-CTR)
    *
    * aes256-ctr (AES256-CTR)
    *
    * aes128-gcm@openssh.com (AES128-GCM_AT_OPENSSH.COM)
    *
    * aes256-gcm@openssh.com (AES256-GCM_AT_OPENSSH.COM)
    *
    * arcfour256 (ARCFOUR256)
    *
    * arcfour128 (ARCFOUR128)
    *
    * aes128-cbc (AES128-CBC)
    *
    * 3des-cbc (3DES-CBC)
    *
    * blowfish-cbc (BLOWFISH-CBC)
    *
    * cast128-cbc (CAST128-CBC)
    *
    * aes192-cbc (AES192-CBC)
    *
    * aes256-cbc (AES256-CBC)
    *
    * arcfour (ARCFOUR)
    *
    * rijndael-cbc@lysator.liu.se (RIJNDAEL-CBC_AT_LYSATOR.LIU.SE)

   Default KEX algorithms  * curve25519-sha256@libssh.org
    *
    * ecdh-sha2-nistp256
    *
    * ecdh-sha2-nistp384
    *
    * ecdh-sha2-nistp521
    *
    * diffie-hellman-group-exchange-sha256
    *
    * diffie-hellman-group14-sha1

   Default MAC algorithms  * umac-64-etm@openssh.com
    *
    * umac-128-etm@openssh.com
    *
    * hmac-sha2-256-etm@openssh.com
    *
    * hmac-sha2-512-etm@openssh.com
    *
    * hmac-sha1-etm@openssh.com
    *
    * umac-64@openssh.com
    *
    * umac-128@openssh.com
    *
    * hmac-sha2-256
    *
    * hmac-sha2-512
    *
    * hmac-sha1

 *
 *
 *  The SSH client always initiates the banner exchange. During the SSH2 banner exchange, use CR+LF termination for the banner. The SSH client ignores any message from the SSH server until the banner exchange.

Back to top

Installation  *
 * show other-sensors
 *
 * show sensors-other
 *

Back to top

GatewayScript  *
 * clear gatewayscript-cache path
 *

Back to top

File management  *
 *  isamwebroot local policyframework

Back to top

Monitors  *
 * type
 *
 * block
 *
 * shape
 *
 * type command
 *

Back to top

Change history
Last modified: 30 October 2017.  * 30 October 2017: Added information about nonexisting block keyword for Message Filter Action type command.
 * 19 October 2017: Added information about which directories you can create and remove subdirectories.
 * 19 July 2016: Added data about the wrong command troubleshooting command in the installation documentation.
 * 17 June 2016: Added data about the undocumented Global command.
 * 22 March 2016: Created for 7.5.

Back to top

Question: When DataPower 7.5.2.x is acting as an SFTP client, what Key Exchange and Mac Algorithms are offered in the SSH handshake? By default which algorithms are offered by DataPower on firmware 7.5.2?

Answer:
Default KEX algorithms  * curve25519-sha256@libssh.org
    *
    * ecdh-sha2-nistp256
    *
    * ecdh-sha2-nistp384
    *
    * ecdh-sha2-nistp521
    *
    * diffie-hellman-group-exchange-sha256
    *
    * diffie-hellman-group14-sha1

   Default MAC algorithms  * umac-64-etm@openssh.com
    *
    * umac-128-etm@openssh.com
    *
    * hmac-sha2-256-etm@openssh.com
    *
    * hmac-sha2-512-etm@openssh.com
    *
    * hmac-sha1-etm@openssh.com
    *
    * umac-64@openssh.com
    *
    * umac-128@openssh.com
    *
    * hmac-sha2-256
    *
    * hmac-sha2-512
    *
    * hmac-sha1


IBM Data Server Manager (DSM) showing SQLCODE=-206 "<name> is not valid in the context where it is used." - United States SQLCODE 206 -206 SQL0206 SQL0206N DSM incompatible db2level fixpack fix pack db2iupdt TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 Data Server Manager log files are full of SQLCODE=-206 "<name> is not valid in the context where it
is used." error

SYMPTOM
The symptoms can vary depending on each installation.

Most common scenario, DSM shows Data Pending status for the monitored database.

CAUSE
When you apply a new DB2 fixpack, the db2iupdt command is used to update an instance to a higher level within a release.

But that command does not necessarily update the database system catalog to support the new fix pack that you have installed.
Meaning, just because the db2level shows a higher level, your database can still be using routines from an older DB2 level.

DIAGNOSING THE PROBLEM
One way to verify what routine levels your database is using, you can run the following DB2 command on the monitored database:

db2 "select versionnumber from sysibm.sysversions order by 1 desc"

If the results is showing a lower level than the ones DSM supports, that means your environment
is not supported, and you are getting the SQLCODE=-206 error.

To verify what are the DB2 levels supported by DSM, please refer to the links below:
- System requirements for IBM Data Server Manager, version 1.1.2 [http://www-01.ibm.com/support/docview.wss?uid=swg27045176]
- System requirements for IBM Data Server Manager, version 2.1 [http://www-01.ibm.com/support/docview.wss?uid=swg27048115]

RESOLVING THE PROBLEM
Run the db2updvnn command according to the db2level of your monitored database:

- For DB2 V9.7 run db2updv97 [https://www.ibm.com/support/knowledgecenter/SSEPGG_9.7.0/com.ibm.db2.luw.admin.cmd.doc/doc/r0054449.html] command
- For DB2 V10.1 run db2updv10 [https://www.ibm.com/support/knowledgecenter/SSEPGG_11.1.0/com.ibm.db2.luw.admin.cmd.doc/doc/r0054449.html] command
- For DB2 V10.5 run db2updv105 [https://www.ibm.com/support/knowledgecenter/SSEPGG_11.1.0/com.ibm.db2.luw.admin.cmd.doc/doc/r0054449.html] command
- For DB2 V11.1 run db2updv111 [https://www.ibm.com/support/knowledgecenter/SSEPGG_11.1.0/com.ibm.db2.luw.admin.cmd.doc/doc/r0054449.html] command

Question: Why does DSM error log have errors for SQLCODE=-206 errors reported for ISAS core warehouse database? DSM error log have errors for SQLCODE=-206 errors reported for ISAS core warehouse database. How do Isolve the problem?

Answer:
Run the db2updvnn command according to the db2level of your monitored database:

- For DB2 V9.7 run db2updv97 [https://www.ibm.com/support/knowledgecenter/SSEPGG_9.7.0/com.ibm.db2.luw.admin.cmd.doc/doc/r0054449.html] command
- For DB2 V10.1 run db2updv10 [https://www.ibm.com/support/knowledgecenter/SSEPGG_11.1.0/com.ibm.db2.luw.admin.cmd.doc/doc/r0054449.html] command
- For DB2 V10.5 run db2updv105 [https://www.ibm.com/support/knowledgecenter/SSEPGG_11.1.0/com.ibm.db2.luw.admin.cmd.doc/doc/r0054449.html] command
- For DB2 V11.1 run db2updv111 [https://www.ibm.com/support/knowledgecenter/SSEPGG_11.1.0/com.ibm.db2.luw.admin.cmd.doc/doc/r0054449.html] command


IBM Security Bulletin: Persistent cross-site scripting vulnerability in Process Admin Console affecting IBM Business Process Manager (BPM) and WebSphere Lombardi Edition (WLE) CVE-2015-0156 - United States  SECURITY BULLETIN

SUMMARY
 IBM Business Process Manager is vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

VULNERABILITY DETAILS
CVEID:CVE-2015-0156 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0156]

DESCRIPTION:IBM Business Process Manager is vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
CVSS Base Score: 3.5
CVSS Temporal Score: Seehttps://exchange.xforce.ibmcloud.com/vulnerabilities/100792 [https://exchange.xforce.ibmcloud.com/vulnerabilities/100792]for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N)

AFFECTED PRODUCTS AND VERSIONS

 * IBM Business Process Manager Standard V7.5.x, 8.0.x, 8.5.x
 * IBM Business Process Manager Express V7.5.x, 8.0.x, 8.5.x
 * IBM Business Process Manager Advanced V7.5.x, 8.0.x, 8.5.x
 * WebSphere Lombardi Edition 7.2.x

If you are using an earlier unsupported version, IBM strongly recommends to upgrade. REMEDIATION/FIXES
Install the interim fix for APAR JR52420 as appropriate for your current IBM Business Process Manager or IT06812 for your current WebSphere Lombardi Edition environment.

 * IBM Business Process Manager Express [http://www.ibm.com/support/fixcentral/swg/quickorder?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+Business+Process+Manager+Express&release=All&platform=All&function=aparId&apars=JR52420]
 * IBM Business Process Manager Standard [http://www.ibm.com/support/fixcentral/swg/quickorder?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+Business+Process+Manager+Standard&release=All&platform=All&function=aparId&apars=JR52420]
 * IBM Business Process Manager Advanced [http://www.ibm.com/support/fixcentral/swg/quickorder?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+Business+Process+Manager+Advanced&release=All&platform=All&function=aparId&apars=JR52420]
 * WebSphere Lombardi Edition [http://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/WebSphere+Lombardi+Edition&release=All&platform=All&function=aparId&apars=IT06812]

WORKAROUNDS AND MITIGATIONS
None

GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

IMPORTANT NOTE
 IBM strongly suggests that all System z customers be subscribed to the System z Security Portal to receive the latest critical System z security and integrity service. If you are not subscribed, see the instructions on the System z Security web site [http://www.ibm.com/systems/z/solutions/security_subintegrity.html]. Security and integrity APARs and associated fixes will be posted to this portal. IBM suggests reviewing the CVSS scores and applying all security or integrity fixes as soon as possible to minimize any potential risk.

REFERENCES
Complete CVSS v2 Guide [http://www.first.org/cvss/v2/guide]
On-line Calculator v2 [http://nvd.nist.gov/CVSS-v2-Calculator]

RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/psirt]

CHANGE HISTORY
 2015-05-13 - initial version published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Cross reference information Segment Product Component Platform Version Edition Business Integration IBM Business Process Manager Standard Security AIX, Linux, Linux zSeries, Solaris, Windows 8.5.6, 8.5.5, 8.5.0.1, 8.5, 8.0.1.3, 8.0.1.2, 8.0.1.1, 8.0.1, 8.0, 7.5.1.2, 7.5.1.1, 7.5.1, 7.5.0.1, 7.5 Business Integration IBM Business Process Manager Express Security Linux, Linux zSeries, Windows 8.5.6, 8.5.5, 8.5.0.1, 8.5, 8.0.1.3, 8.0.1.2, 8.0.1.1, 8.0.1, 8.0, 7.5.1.2, 7.5.1.1, 7.5.1, 7.5.0.1, 7.5 Business Integration WebSphere Lombardi Edition AIX, HP-UX, Linux, Linux zSeries, Linux/x86, Platform Independent, Solaris, Windows, Windows Vista, Windows XP 7.2.0.5, 7.2.0.4, 7.2.0.3, 7.2.0.2, 7.2.0.1, 7.2

Question: Help with Security Bulletin: Persistent cross-site scripting vulnerability in Process Admin Console affecting IBM Business Process Manager (BPM) and WebSphere Lombardi Edition (WLE) CVE-2015-0156 I need to understand details regarding Security Bulletin: Persistent cross-site scripting vulnerability in Process Admin Console affecting IBM Business Process Manager (BPM) and WebSphere Lombardi Edition (WLE) CVE-2015-0156). Where can I find this information?

Answer:
CVEID:CVE-2015-0156 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0156]

DESCRIPTION:IBM Business Process Manager is vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
CVSS Base Score: 3.5
CVSS Temporal Score: Seehttps://exchange.xforce.ibmcloud.com/vulnerabilities/100792 [https://exchange.xforce.ibmcloud.com/vulnerabilities/100792]for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N)


IBM PureApplication System Release Note: Some component attributes are not available to configure during pattern deployment - United States v2001rlsnotes RELEASE NOTES

ABSTRACT
 Some component attributes are not available to configure during pattern deployment

CONTENT
Problem: If your virtual system pattern includes a component (such as an image, software component or script package) that has a data dependency on another component, but does not have any locked attributes, then the attributes for the component with the data dependency are not presented for configuration during pattern deployment.

Resolution: To show missing component attributes for configuration, lock any one of the attributes, such as the name attribute. This action causes the other component attributes to be displayed for configuration.

Question: Missing option to fill in attributes when trying to deploy a pattern I tried to deploy a pattern and I have some parameters to modify at deployment time. But I can't see my parts/attributes in the Component Attribute List.

Answer: To show missing component attributes for configuration, lock any one of the attributes, such as the name attribute. This action causes the other component attributes to be displayed for configuration.


IBM HTTP Session time-out settings and overwrite precedence rules - United States WebSphere http session management time-out wasrun precedence overwrite TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 It is possible to set the HTTP Session time-out in various places on the IBM® WebSphere® Application Server Administrative Console. It is also possible to set HTTP Session time-out for the application packaging process.

Since Session time-out can be set in multiple places, it is necessary to understand how the ultimate Session time-out for an application is determined.

CAUSE
Application needs HTTP session time-out set.

RESOLVING THE PROBLEM
The HTTP Session time-out can be set in the following places:

 * From the Administrative Console at the server, Enterprise application, and Web application levels
 * At the time when the application is packaged
 * In the application code

Setting the HTTP Session time-out from the Administrative Console
1. To set the HTTP Session time-out at the server level, navigate to Servers > Application Servers > Your Server > Web Container > Session Management.

In the Session time-out section of this window, you can select No time-out or Set time-out by clicking the appropriate radio button. If you choose to set the time-out, type the desired value in minutes in the box.

2. To set the HTTP Session time-out at the Enterprise Application level, navigate to Applications > Enterprise Applications > Your Application > Session Management.

Check Override in the Override Session Management section, then select to set the time-out and the time-out value. This sets the application session to overwrite those values set at the parent, which in this case is the Server level.

3. To set the HTTP Session time-out at the Web Application level, navigate to Applications > Enterprise Applications > Your Application > Web Module > Your Web App.war > Session Management.

Check Override in the Override Session Management section, then select to set the time-out and the time-out value. This sets the Application Session to overwrite those values set at the parent levels, which in this case is the Server or Enterprise Application level.

After modifying these settings, save the master configuration.

Setting HTTP Session time-out when application is packaged

The application developer can also select to set the HTTP Session time-out parameter when the application is packaged. This value is stored in the web.xml file for the Web application.

This setting overrides any session time-outs defined from the Administrative Console. Alter this setting by repackaging the application with a new value, or by modifying the web.xml file. The entry in the web.xml will be as follows:
          <session-config>
      *          <session-timeout>60</session-timeout>
 *
 *       </session-config>

Where the "session-timeout" is an integer value for the desired session time-out in minutes.
Setting HTTP Session time-out from the application code

Finally, the HTTP Session time-out can be set in the application code. The programmer can invoke the setMaxInactiveInterval() method on HttpSession object to set the time-out value as desired. This setting overrides any time-out defined in the application package or made from the Administrative Console.

HTTP Session time-out Override Precedence Summary

The list below shows the precedence from which the final HTTP Session time-out is derived.

1. Server Level [/support/docview.wss?uid=swg21163875&aid=1] Lowest level 2. Enterprise Application [/support/docview.wss?uid=swg21163875&aid=1] Overrides the Server Level if Override is selected 3. Web Application [/support/docview.wss?uid=swg21163875&aid=1] Overrides the Server and Enterprise Application settings if Override is selected 4. Application Level (web.xml) [/support/docview.wss?uid=swg21163875&aid=1] Overrides Server, Enterprise Application, and Web Application settings 5. Application Code [/support/docview.wss?uid=swg21163875&aid=1] Overrides all other settings RELATED INFORMATION
 A simplified Chinese translation is available [http://www.ibm.com/support/docview.wss?uid=swg21659740]

Cross reference information Segment Product Component Platform Version Edition Application Servers Runtimes for Java Technology Java SDK

Question: How to set session time out period for a single user in DASH? How to set session time out period for a single user in DASH?

Answer:
The HTTP Session time-out can be set in the following places:

 * From the Administrative Console at the server, Enterprise application, and Web application levels
 * At the time when the application is packaged
 * In the application code


IBM "An invalid XML character" error is thrown when handling data originating from a WebSphere Adapter - United States Unicode invalid character 0x0 xml serialize serialization XSLT XLS error TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 WeBSphere Adapter is unable to process data from a source containing unicode data due to a serialization error in the broker indicating that "An invalid XML character (Unicode: 0x0) was found in the element content".

SYMPTOM
When processing data using a broker that originates from a WebSphere JCA Adapter, you encounter an exception of the following form:

Source = java.lang.RuntimeException caught trying to serialize BO BusinessObject: F4211BeginDoc@382a382a (F4211FSBeginDoc=F4211FSBeginDoc@67e667e6) probeid = 214 Stack Dump = java.lang.RuntimeException: An invalid XML character (Unicode: 0x0) was found in the element content:

This error occurs while you are performing data transformations within your broker, either for an XSLT or to enable monitoring or tracing of the data stream, and results in a flow failure.

CAUSE
The problem occurs when the source data contains unicode data which is not allowed in XML. In the above example, this is the unicode character 0x0, but there are a number of other unicode characters that can cause the same result. The problem does not occur in the WebSphere Adapter itself because the WebSphere Adapters are entirely capable of handling full unicode data. Rather, the problem happens in some brokers which fail to properly serialize the incoming data into a valid XML object.

RESOLVING THE PROBLEM
The only complete solution at this time is to not process unicode characters that are not valid in XML. This can be done by not importing data fields that might contain such characters or by purging such characters from the incoming data source. It is not sufficient to do filtering in the BO maps since the broker can still run into problems prior to this Java™ mapping.

If handling of fields containing these unicode characters is essential to your use case, it will be necessary to open a PMR with your broker's support team (rather than the WebSphere Adapter team) to determine if there are any alternatives available.

HISTORICAL NUMBER
 75349
344
000

Question: How to Create an Application with the the Websphere Adapter for Flat File using Hex05 delimeter? How to Create an Application with the the Websphere Adapter for Flat File using Hex05 delimeter?

Answer: The only complete solution at this time is to not process unicode characters that are not valid in XML. This can be done by not importing data fields that might contain such characters or by purging such characters from the incoming data source.


IBM ERROR: Default DB path is not set, when adding database set on RHEL 5 - United States 1320206; ClearQuest; Command Line Tools; CQ; cqreg; add_dbset; initialize; CQ_DATABASES; CQDB_rgys; registry; db set; db_set; Default DB path is not set; Use cqreg initialize first; linux; RHEL; RHEL5 TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 This technote explains why the error, "Default DB path is not set", occurs when adding a connection with IBM® Rational® ClearQuest® on RedHat Enterprise Linux® (RHEL) 5.

SYMPTOM
When running the command cqreg add_dbset, this error occurs:

"Default DB path is not set"
"Default version is 7.0.0"
/opt/rational/clearquest/CQDB_rgys/cqdb_registry/7.0.0 does not exist. Use cqreg initialize first.

CAUSE
Normally, at the end of a ClearQuest installation on UNIX® based platforms, the cqreg initialize command runs automatically. The command creates the registry structure for database sets. During the installation, the command did not run successfully.

DIAGNOSING THE PROBLEM
Verify that the CQDB_rgys directory exists, as defined in the installation options. The following is the default registry location:

/opt/rational/clearquest/CQDB_rgys/cqdb_registry/

If not present, then the cqreg initialize command was not successful.

RESOLVING THE PROBLEM
Run cqreg initialize. The add_dbset command will run successfully afterwards. However, should the same error persist, make sure the command is run as the root user.

Also make sure that the CQ_DATABASES environment variable is set to the desired registry path. If it is not, set the variable accordingly, then run the previously mentioned commands again.

Question:
CQWEB  can\'t retrieve repository dropdown list options in RedHat Linux, how to deal with it ? I setup a cq demo env in redhat linux with oracle database, CQ 7.1.2, LRKS 8.1.3,  Linux CQ client can login CQ as the following picture 1, but CQWEB login page can't retrieve the repository dropdown list options as the following picture 2.  I used cqreg to register CQ database:

cqreg add_dbset -v ORACLE -s 192.168.0.84 -d ESBDB -u cqadmin -p cqadmin -dbset CQ_DEMO_ORACLE -co LOB_TYPE=CLOB -force

 How do I deal with it?

Answer:
Run cqreg initialize. The add_dbset command will run successfully afterwards. However, should the same error persist, make sure the command is run as the root user.

Also make sure that the CQ_DATABASES environment variable is set to the desired registry path. If it is not, set the variable accordingly, then run the previously mentioned commands again.


IBM PureData Systems for Analytics - nzsql error, Records trailing spring space set to 512 is too small - United States netezza PDA TECHNOTE (FAQ)

QUESTION
 What does the message "ERROR: Records trailing spring space set to 512 is too small..." mean?

ANSWER
The following error may appear in the pg.log file:

ERROR: Records trailing spring space set to 512 is too small : Bump it up using the environment variable NZ_SPRINGFIELD_SIZE

This error can occur when a query includes multiple aggregates against varchar or nvarchar columns. As the query is being processed the system allocates memory for each row of the result set. This includes each of the GROUP BY columns and each of the aggregates. For queries doing aggregates on variable length columns, the total length of the record will vary during the process. For example, if the current min value is "Boston" and the new min value is "Albuquerque" space for the new min value needs to increase.

The NZ_SPRINGFIELD_SIZE is an extra pseudo-column that is tacked onto each row. It does not contain any data. It is a filler that starts out at NZ_SPRINGFIELD_SIZE and then dynamically shrinks and expands as needed to keep each of the aggregate rows at a fixed length. There is a single springfield in each grouping record that has to shrink and grow to offset the combined changes in width of the running values for all min/max aggregates.

To avoid this error message, increase the value for this parameter as follows:

1. nzstop
2. export NZ_SPRINGFIELD_SIZE=1024
3. nzstart

You can confirm that the environment variable took effect by running the command "nzsystem showregistry". The output should contain the following: "system.maxSpringFieldSize = 1024".

Unfortunately, the setting for NZ_SPRINGFIELD_SIZE will revert to its default value the next time the database is stopped and started without the NZ_SPRINGFIELD_SIZE environment variable being set. To ensure that the setting persists after every database restart, do the following:
1. Add the following line to the /nz/data/config/system.cfg file. (Create the file if it does not exist.)

system.maxSpringFieldSize = 1024
2. nzstop
3. nzstart

If 1024 does not work, try higher values. Setting the limit may take a little trial and error. Increasing this value should not have a noticeable impact on other system performance.

Note: "By default 512 bytes is allocated to each row taking part in aggregations. By increasing this value by 512 we allocate over 30MB more memory for every 1 000 000 rows participating in aggregations. This is for one query, there might be other queries in the system which do aggregations as well. The more memory that is allocated for NZ_SPRINGFIELD_SIZE (for each row) the less memory left for other processes. Having said this, it is not uncommon to see NZ_SPRINGFIELD_SIZE set to 8192 without consequence but care must be taken and one must still be aware of how increasing NZ_SPRINGFIELD_SIZE will impact resources, thus increase it wisely. "

HISTORICAL NUMBER
 NZ755310

Question: What does the message "ERROR: Records trailing spring space set to 512 is too small..." mean? What does the message "ERROR: Records trailing spring space set to 512 is too small..." mean?

Answer: This error can occur when a query includes multiple aggregates against varchar or nvarchar columns. As the query is being processed the system allocates memory for each row of the result set. This includes each of the GROUP BY columns and each of the aggregates. For queries doing aggregates on variable length columns, the total length of the record will vary during the process.


IBM When a Certificate Authority (CA) signs a certificate using SHA2(SHA-256), IBM Websphere DataPower SOA Appliance can validate the signature of CA on certificate. - United States Datapower DP valcred SHA2 SHA-2 SHA-256 certificate trust CA TECHNOTE (FAQ)

QUESTION
 When a Certificate Authority(CA) signs a certificate using SHA2(SHA-256), can IBM Websphere DataPower SOA Appliance validate the certificate and trust chain?

ANSWER
 Yes, if a Certificate Authority(CA) signs a certificate using SHA2(SHA-256), IBM Websphere DataPower SOA Appliance can validate CA's signature on the certificate while building trust chain from the DataPower ValCred.

Cross reference information Segment Product Component Platform Version Edition Business Integration WebSphere DataPower SOA Appliances General Firmware 3.8.1, 3.8, 3.7.3, 3.7.2

Question: DataPower support for SHA-2 Does DataPower support the SHA-256 cryptographic hash function?

Answer: Yes, if a Certificate Authority(CA) signs a certificate using SHA2(SHA-256), IBM Websphere DataPower SOA Appliance can validate CA's signature on the certificate while building trust chain from the DataPower ValCred.


IBM Syndicating to VP with exclusive realms does not work. - United States syndication; realm; vp; admin user; getPortalAdministrator TECHNOTE (TROUBLESHOOTING)

PROBLEM

Syndication from base Portal to Virtual Portal with different realms does not work:-

1) Create 2 different realms with different base entries and map one realm ( with base entry e.g DC=org1,DC=test) to base Portal.

2) Create a Virtual portal and map it to another realm ( with base entry e.g DC=org2,DC=test).

3) Attempt to carry out syndication from Base Portal to Virtual Portal.

4) The syndication fails with below exception:

[datetime] 0000007f PackageGenera I createIceProjectItemRemoves():: p_items length = 0
[datetime] 0000008b ResponseBL I Performing response for sender: 1abc2a07-e70a-4804-8e09-b7b897eef534
[datetime] 000000a1 SubscriberTas E Unexpected exception thrown while updating subscription: [IceId: <1abc2a07-e70a-4804-8e09-b7b897eef534> Current State: <ICE-INITIAL>], exception: com.presence.connect.wmmcomms.exception.MemberNotFoundException: Message: com.ibm.portal.WpsException: EJPSG0002E: Requested Member does not exist.uid=wpsadmin,cn=users,DC=XYZ,DC=TEST, Cause: com.ibm.wps.um.exceptions.impl.MemberNotFoundExceptionImpl: com.ibm.portal.WpsException: EJPSG0002E: Requested Member does not exist.uid=wpsadmin,cn=users,DC=XYZ,DC=TEST com.presence.connect.wmmcomms.exception.MemberNotFoundException: Message: com.ibm.portal.WpsException: EJPSG0002E: Requested Member does not exist.uid=wpsadmin,cn=users,DC=XYZ,DC=TEST, Cause: com.ibm.wps.um.exceptions.impl.MemberNotFoundExceptionImpl: com.ibm.portal.WpsException: EJPSG0002E: Requested Member does not exist.uid=wpsadmin,cn=users,DC=XYZ,DC=TEST
[...]
at com.presence.connect.wmmcomms.UserManagementServiceImpl.getPortalAdministrator(UserManagementServiceImpl.java:1678)
[...]

CAUSE

The Admin user exists on Base Portal but not the Realm which is configured to Virtual Portal.

The Administrator User who is listed as the Domain Admin retrieved with:
com.presence.connect.wmmcomms.UserManagementServiceImpl.getPortalAdministrator() does not have access to the Virtual Portal.

RESOLVING THE PROBLEM

The Admin user has to be made visible on both base and virtual Portals if you wish to syndicate between the two.

When syndicating to Virtual Portals, the Administrator User who is listed as the Domain Admin retrieved with:
com.presence.connect.wmmcomms.UserManagementServiceImpl.getPortalAdministrator() should have access to the Virtual Portal.

RELATED INFORMATION
 Realm Support [http://www-10.lotus.com/ldd/portalwiki.nsf/xpDocViewer.xsp?lookupName=IBM%20WebSphere%20Portal%208%20Product%20Documentation&documentId=3B264D090122D90D85257B26000692C6&action=openDocument&rev=true&mode=original&content=pdcontent]

Question:
Cannot create syndication pair between Virtual Portals with a different user repository than Base Portal Steps:
I have two different user repositories one to manage my base portal and Virtual Portals. (p.e: For Base Portal I use ITDS, and for VPs I use AD) with differents admin users each.
Then I created two VPs using the AD repository, and my VPs admin user on the credential vault.
Tried to create a syndication relationship , that is failing with the error:
"Could not communicate with the target URL. Please check that the Syndicator URL details are entered correctly, and that the credential slot user exists on the target server."

Answer:
The Admin user has to be made visible on both base and virtual Portals if you wish to syndicate between the two.

When syndicating to Virtual Portals, the Administrator User who is listed as the Domain Admin retrieved with:
com.presence.connect.wmmcomms.UserManagementServiceImpl.getPortalAdministrator() should have access to the Virtual Portal.